I don't have much routing tables in my ELK setup and firewall is inactive.
This is my tcpdump for 5000 port:
listening on eth2, link-type EN10MB (Ethernet), capture size 262144 bytes
14:27:01.819435 IP 192.168.129.1.49666 > ELK.5000: UDP, length 105
14:27:01.819512 IP 192.168.129.1.49666 > ELK.5000: UDP, length 110
14:27:02.026195 IP 192.168.129.1.49666 > ELK.5000: UDP, length 164
14:27:02.059464 IP 192.168.129.1.49666 > ELK.5000: UDP, length 63
14:27:02.082236 IP 192.168.129.1.49666 > ELK.5000: UDP, length 121
When I go inside the container of logstash, I could see the same dump.
tcpdump inside the container:
listening on eth2, link-type EN10MB (Ethernet), capture size 262144 bytes
14:30:20.060804 IP 192.168.129.1.49666 > ELK.commplex-main: UDP, length 135
14:30:20.060858 IP 192.168.129.1.49666 > ELK.commplex-main: UDP, length 99
14:30:20.138807 IP 192.168.129.1.49666 > ELK.commplex-main: UDP, length 104
I feel this is making some difference.